Overview

overview

10

Static

static

3

setup_r8011.exe

windows10-2004-x64

10

setup_r8011.exe

windows11-ltsc_2024-x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target
    setup_r8011.zip
  • Size 6.0MB
  • Sample260806-bfs51sfa42
  • SHA256 d1568452c923f70fd06484ed69f5b8724a105eb57b133d9c68903d505ccf801f
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
defense_evasionexecutionpersistence

Malware Config

Targets

    • Target
      setup_r8011.exe
    • Size 61.7MB
    • SHA256 4ad5711e139372efe4fbaea62ad2737c77f3012c2e837bc0c30cbae4597239b2
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    10/10
    defense_evasionexecutionpersistence

    • SilverFox-style Panasonic/Sauron loader chain targeting the staged Panasonic wrapper, image-named Al

      SilverFox-style Panasonic/Sauron loader chain with staged loader, Alibaba OSS carrier grammar, side-loaded UxEnhance64.dll, RPC Task Scheduler payload, adoresd bridge, and Sauron Edge stage.

    • Command and Scripting Interpreter: PowerShell

      Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

      execution

    • Executes dropped EXE

    • Loads dropped DLL

    • Adds Run key to start application

      persistence

    • Indicator Removal: Clear Persistence

      Clear artifacts associated with previously established persistence like scheduletasks on a host.

      defense_evasion

    • Drops file in System32 directory

    behavioral1behavioral2

MITRE ATT&CK Enterprise v16

Tasks